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Top Stories 

• Wolverine Packing Company issued a recall May 19 for about 1.8 million pounds of 
ground beef products due to possible E. coli 0157:H7 contamination linked to 11 illnesses 
in 4 States between April 22 and May 2. - U.S. Department of Agriculture (See item H) 

• Kraft Foods Group issued a recall May 17 for 1.2 million cases of cottage cheese when 
ingredients used in nearly 3 dozen products were not properly stored at a Kraft facility in 
California. - CNN Money (See item 12 ) 

• An employee was arrested and charged for allegedly stealing around 2,500 prescription 
pills from Stoll’s Pharmacy in Waterbury, Connecticut, after an audit found that around 
20,000 pills were missing from the pharmacy. - WVIT 30 New Britain (See item 19 ) 

• The U.S. Department of Justice announced criminal charges May 19 against five members 
of the Chinese military’s Unit 61398 for allegedly conducting cyberespionage against U.S. 
solar power, nuclear power, and metals manufacturing companies for the purpose of 
stealing trade secrets. - NBC News; Reuters (See item 22 ) 
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Energy Sector 



1. May 17, Florida Today - (Florida) Port St. John gas line rupture under 

investigation. Officials are investigating after a 36-inch natural gas pipeline leaked in 
Brevard County May 17 prompting nearby homes to evacuate in Port St. John and 
halting train and vehicle traffic for nearly 3 hours. Crews inspected the west side of 
U.S. 1 near the Florida Power & Light plant after receiving reports of a loud noise. 
Source: http://www.floridatoday.com/storv/news/local/2014/05/17/gas-leak-prompts- 
evacuations-in-north-cocoa/92 10351/ 



For another story, see item 22 
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Chemical Industry Sector 

Nothing to report 
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Nuclear Reactors, Materials, and Waste Sector 

See item 22 
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Critical Manufacturing Sector 

2. May 17, KABC 7 Los Angeles; ABC News - (National) Hyundai recalls Tucson SUVs 
due to airbag issue. Hyundai announced a recall of 137,500 model year 201 1-2014 
Tucson vehicles due to the vehicles’ steering wheel airbags being improperly mounted, 
which could cause the airbags to come loose and increase the risk of injury in a crash. 
Source: http://abc7.com/news/hyundai-recalls-tucson-suvs-due-to-airbag-issue/65346/ 

For another story, see item 22 
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Defense Industrial Base Sector 

Nothing to report 
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Financial Services Sector 

3. May 19, The Register - (International) LifeLock snaps shut Wallet mobile app over 
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credit card leak fears. LifeLock removed its Wallet app from application markets and 
deleted user data as a precaution due to undisclosed elements of the app being 
incompatible with the payment card industry’s Data Security Standard (PCI DSS), 
according to a company statement. 

Source: http://www.theregister.co.uk/2014/05/19/lifelock yanks mobile app / 

4. May 17, WHTM 27 Harrisburg - (National) Bank robberies linked to serial bandit. 
Police stated that the suspect in the April 4 robbery of a Union Community Bank 
branch in Columbia, Pennsylvania, may be responsible for at least eight other robberies 
in Pennsylvania and New Jersey since November 19, 2013. Police also believe that the 
suspect could be responsible for additional bank robberies in Delaware, Maryland, and 
New York. 

Source: http://www.abc27.com/storv/25539606/bank-robberies-linked-to-serial-bandit 

5. May 16, SC Magazine - (Pennsylvania) Hackers exploit vulnerability to breach 
Pennsylvania payroll company. Pennsylvania-based payroll processing company 
Paytime Inc., stated that an undisclosed number of clients may have had their personal 
and payment information exposed when attackers exploited a vulnerability in the 
company’s Client Service Center. Paytime learned of the breach April 30 and found 
that the breach began April 7. 

Source: http://www.scmagazine.com/hackers-exploit-vulnerability-to-breach- 
pennsvlvania-pavroll-company/article/347371/ 
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Transportation Systems Sector 

6. May 18, KTLA 5 Los Angeles - (California) Worker killed after bridge collapses on 
91 Freeway in Riverside. A worker was killed after a support beam began to collapse 
during the demolition of the bridge at the Pachappa Railroad Overcrossing, prompting 
the shutdown of eastbound lanes as well as two westbound lanes on the 91 Freeway in 
Riverside for about 11 hours May 18. 

Source: http://ktla.com/2014/05/18/eastbound-91-freeway-closed-after-fatal-bridge- 
collapse/ 

7. May 18, Sierra Vista Herald/Bisbee Daily Review - (Arizona) Crash at Fort 
Huachuca airport injures 2. Authorities are investigating after two people aboard a 
Cessna 500 were injured when the airplane crashed May 17 at the joint Libby Army 
Airfield and Sierra Vista Municipal Airport. 

Source: http://www.eacourier.com/news/crash-at-fort-huachuca-airport- 
injures/article 22e64fd8-df00-lle3-897b-001a4bcf887a.html 

8. May 18, Boston Herald - (Massachusetts) T bus crash on Pike overpass in Newton 
injures 8. Seven passengers and the bus driver were injured after a Massachusetts Bay 
Transportation Authority bus crashed through a guardrail on the Massachusetts 
Turnpike overpass in Newton, which caused the bus to hang partially over the highway 
May 18. Newton firefighters secured the bus and officials are investigating the incident. 
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Source: 

http://bostonherald.com/news opinion/local coverage/20 14/05/t bus crash on pike o 
verpass in newton injures 8 

9. May 16, Rappahannock News - (Virginia) Closed by tanker accident, westbound I- 
66 likely reopening at 2 p.m. Westbound lanes of Interstate 66 in Warren County were 
closed for several hours May 16 after an accident involving a semi-truck carrying 
gasoline. Virginia Department of Transportation officials reported that several areas 
across 9 counties were also closed to motorists due to flooding after a storm. 

Source: http://www.rappnews.com/2014/05/16/i-66-west-closed-by-tanker-accident- 
near- front-royal/ 129942/ 

10. May 16, Rock Hill Herald - (South Carolina) Fuel tanker truck overturned in 
Lancaster County. A section of South Carolina 97 in Lancaster County was closed 
indefinitely after a semi-truck carrying fuel overturned and leaked diesel fuel and 
gasoline May 16. Crews responded to the scene to contain the spill. 

Source: http ://www .heraldonline.com/20 1 4/05/1 6/5 97 07 60/fuel-tanker-truck- 
overtumed-in.html 

For another story, see item 1 
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Food and Agriculture Sector 

11. May 19, U.S. Department of Agriculture - (National) Michigan firm recalls ground 
beef products due to possible E. coli 0157:H7. The Food Safety and Inspection 
Service (FSIS) announced May 19 that Wolverine Packing Company of Detroit issued 
a recall for approximately 1.8 million pounds of ground beef products due to possible 
E. coli 0157:H7 contamination. An investigation by the FSIS determined that there is a 
link between the ground beef products and 11E. coli 0157:H7 illnesses identified in 4 
States between April 22 and May 2. 

Source: http://www.fsis.usda.gov/wps/portal/fsis/topics/recalls-and-public-health- 
alerts/recall-case-archive/archive/2014/recall-030-2014 

12. May 18, CNN Money - (National) Kraft recalls cottage cheese citing illness risk. 
Kraft Foods Group issued a recall May 17 for 1.2 million cases of Knudsen, 
Breakstone, Simply Kraft, and Daily Chef branded cottage cheese when ingredients 
used in nearly 3 dozen products were found to have not been properly stored at a Kraft 
facility in California. Officials halted production of the affected products and are 
working to resolve the issue at the facility. 

Source: http://monev.cnn.com/2014/05/18/news/kraft-cottage-cheese-recall/ 

13. May 17, Food Poisoning Bulletin - (National) Pork products recalled due to 
misbranding. Transatlantic Foods of New York issued a recall for 449,000 pounds of 
pork products due to misbranding after the company used labels with false “no 
antibiotic” claims. The company issued a separate recall for an additional 222,000 
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pounds of pork and poultry products that did not receive the full benefit of federal 
inspection. 

Source: http://foodpoisoningbulletin.com/2014/pork-products-recalled-due-to- 
misbranding/ 

14. May 16, Food Poisoning Bulletin - (Michigan) E. coli in raw milk sickens 2 in MI. 
Health officials from Kent, Ottawa, and Muskegon Counties in Michigan issued a joint 
press release May 16 stating that 2 individuals in Michigan were sickened by E. coli 
0157:H7 after drinking unpasteurized milk produced by an Ottawa County cow share. 
Source: http://foodpoisoningbulletin.com/2014/e-coli-in-raw-milk-sickens-2-in-mi/ 
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Water and Wastewater Systems Sector 

15. May 18, Milwaukee Journal Sentinel - (Wisconsin) Dozens of Milwaukee water 
mains break as utility scrambles to fix leak. Crews in Milwaukee worked May 18 
through May 19 to repair 33 water main breaks that occurred mostly in the city’s 
northwest area following the shutdown of a pumping station. The shutdown of the 
pumping station due to an 84-inch pipe leak led to the shutdown of a second station, 
which necessitated an increase of water pressure at a third station, leading to the water 
main breaks. 

Source: http://www.isonline.com/news/milwaukee/dozens-of-miwaukee-water-mains- 
break-as-utility-scrambles-to-fix-leak-b99272885zl-259714511.html 

16. May 17, WRC 4 Washington, D.C. - (Washington, D.C.) Sewage spill closes Capital 
Crescent Trail again. Heavy rains May 15 caused thousands of gallons of water and 
sewage to overflow onto the Capital Crescent Trail in Washington, D.C., prompting a 
portion of the trail to close after a failure of an underground mechanical device. A 
previous overflow closed the trail and workers continued to investigate the cause of the 
second overflow. 

Source: http://www.nbcwashington.com/news/local/Sewage-Spill-Closes-Capital- 
Crescent-Trail-Again-25 953603 1 .html 

17. May 16, WKYT 27 Lexington - (Kentucky) Crews trying to keep Powell County oil 
spill from polluting drinking water supply. Powell County crews worked to contain 
an oil spill and prevent it from reaching the Red River, potentially impacting drinking 
water in the area, after thieves caused around 1,000 gallons to spill May 15 while 
attempting to steal a pipe from a disused oil tank. 

Source: http://www.wkyt.com/news/crimetracker/headlines/Theft-causes-Powell- 
County-oil-spill-259478401 .html 
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Healthcare and Public Health Sector 

18. May 16, Connecticut Post - (Connecticut) More than 3,100 diabetes patients exposed 
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to HIV risk. Officials from Griffin Hospital in Connecticut announced May 16 that 
more than 3,100 patients should be tested for hepatitis B, hepatitis C, and HIV after 
staff misused insulin pens on patients that were hospitalized beginning in September 
2008. The hospital stopped using the FlexPens and an investigation is underway after 
authorities learned nurses used the injector part of the insulin pens on more than one 
patient, leading to possible contamination. 

Source: http://www.ctpost.com/local/article/More-than-3-100-diabetes-patients- 
exposed-to-HIV-5484528.php 

19. May 16, WV1T 30 New Britain - (Connecticut) Pharmacy tech stole thousands of 
pills: Police. A Stoll’s Pharmacy employee was arrested and charged for allegedly 
stealing around 2,500 prescription pills from the Waterbury pharmacy. An audit found 
that around 20,000 pills were missing from the pharmacy and surveillance videos 
captured the technician stealing bottles of pills from a safe. 

Source: http://www.nbcconnecticut.com/news/local/Pharmacy-Tech-Stole-Thousands- 
of-Pills-Police-259539161.html 



20. May 16, KNOE 8 Monroe - (Louisiana) Major copper theft ring broken up in 

Newellton. Authorities arrested five men in connection with removing copper from the 
old Tensas Medical Center in Newellton, which caused hundreds of thousands of 
dollars in damages. The men are also accused of stealing copper from several other 
buildings, including the New Birth Christian Center, where damages totaled close to 
$45,000. 

Source: http://www.knoe.com/story/25536444/maior-copper-theft-ring-broken-up-in- 
newellton 
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Government Facilities Sector 

21. May 16, Los Angeles Times - (California) Man pleads not guilty to arson in southern 
California wildfire. An Oceanside man pleaded not guilty to an arson charge after 
authorities suspected him of throwing brush into a 105-acre fire in the San Luis Rey 
River area. Firefighters worked to contain several wildfires in the San Diego area that 
burned 19,826 acres by May 16 and prompted evacuation orders for thousands of 
residents. 

Source: http://www.latimes.com/local/lanow/la-me-ln-arson-arrest-wildfire-20140516- 
story.html 

For another story, see item 16 
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Emergency Services Sector 

Nothing to report 



- 6 - 



[Return to top ] 



Information Technology Sector 

22. May 19, NBC News; Reuters - (International) U.S. charges China with cyber-spying 
on American firms. The U.S. Department of Justice announced criminal charges May 
19 against five members of the Chinese military’s Unit 61398 for allegedly conducting 
cyberespionage against U.S. solar power, nuclear power, and metals manufacturing 
companies for the purpose of stealing trade secrets. 

Source: http://www.nbcnews.com/news/us-news/u-s-charges-china-cvber-spying- 
american-firms-nl08706 



23. May 19, Softpedia - (International) 81 people arrested in international operation 
against BlackShades RAT users. Law enforcement agencies in 13 countries arrested 
81 people the week of May 12 for allegedly being involved in the creation, sale, or use 
of the BlackShades remote access trojan (RAT). The BlackShades RAT can be used to 
hijack webcams, log keystrokes, steal files, and launch denial of service (DoS) attacks 
and is sold on underweb markets. 

Source: http://news.softpedia.com/news/81-People-Arrested-in-International- 
Operation-Against-BlackShades-RAT-Users-442833.shtml 

24. May 19, Help Net Security - (International) Record month for Linux trojans. 
Researchers at Dr. Web identified a record-high number of trojans for the Linux 
operating system thus far in the month of May, with variants of three separate trojans 
appearing to be created by the same author. The majority of the trojans are designed to 
carry out distributed denial of service (DDoS) attacks and can infect Linux desktop, 
server, and ARM distributions. 

Source: http://www.net-securitv.org/malware news.php?id=2768 

25. May 19, Softpedia - (International) XSS vulnerability affected comments section of 
hundreds of Yahoo pages. A researcher identified and reported a cross-site scripting 
(XSS) vulnerability affecting hundreds of Yahoo pages via the pages’ comment 
sections that could be used to perform a persistent XSS attack that would affect all 
visitors or a self-XSS attack that would only affect users if the comment with the 
malicious code was a popular or recent comment. Yahoo closed the vulnerability after 
being notified. 

Source: http://news.softpedia.com/news/XSS-Vulnerability-Affected-Comments- 
Section-of-Hundreds-of-Yahoo-Pages-442754.shtml 

26. May 19, Softpedia - (International) Yahoo, Microsoft and Orange domains affected 
by same remote code injection flaw. A researcher identified and reported a remote 
code injection vulnerability affecting several subdomains belonging to Yahoo, 
Microsoft, Orange, and others that could allow an attacker to access an administrator 
panel without login credentials. The vulnerability appears to be connected to an 
astrology content delivery network, and Y ahoo, Orange, and Microsoft closed the 
vulnerabilities once informed. 

Source: http://news.softpedia.com/news/Yahoo-Microsoft-and-Orange-Domains- 
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Affected-by-Same-Remote-Code-Iniection-Flaw-442776.shtml 



27. May 16, SC Magazine - (International) Critical info on modems, load balancer, 
exposed via SNMP community string. Researchers at Rapid7 reported that 
information disclosure vulnerabilities were identified in Brocade Serverlron ADX 
1016-2-PREM TrafficWork application load balancers and Ambit U10C019, Ubee 
DDW3611, and Netopia 3347 modems. The vulnerability can be exploited by the 
Simple Network Management Protocol (SNMP) public community string and can 
disclose Management Information Base (MIB) tables that contain device and 
configuration information. 

Source: http://www.scmagazine.com/critical-info-on-modems-load-balancer-exposed- 
via-snmp-community-string/article/347393/ 

Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 



[ Return to top ] 



Communications Sector 

28. May 16, Olney Daily Mail - (Illinois) Friday Internet outage affects Frontier 

customers. Frontier Communications representatives stated that a configuration issue 
with a router in a company office was resolved and Internet service was restored to 
customers in Olney, Illinois, after a 4-hour outage May 16. 

Source: 

http://www.olnevdailvmail.com/article/20140516/NEWS/140519457/10054/NEWS 
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Commercial Facilities Sector 

29. May 19, WRC-TV 4 Washington, D.C. - (Virginia) Explosion of two plastic 'bottle 
bombs' leads to NoVa theater evacuation. About 2,000 people were evacuated from 
the AMC Theater and a nearby food court at Tysons Comer Center in McLean, 
Virginia, May 18 after two devices made out of plastic bottles filled with acid and 
metals exploded inside the theater. Authorities reported no injuries and are 
investigating the incident. 

Source: http://www.nbcwashington.com/news/local/Tvpsons-Movie-Popping-Water- 
Bottle-Evacuation-259709221.html 

30. May 19, Boston Globe - (Massachusetts) 18 people displaced and firefighter injured 
in Peabody blaze. Eighteen residents were displaced from a Peabody, Massachusetts 
apartment building May 18 after a fire broke out and destroyed the structure’s roof and 
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caused an estimated $400,000 in damage to the building. One firefighter was 
transported to a local hospital for smoke inhalation. 

Source: http://www.bostonglobe.com/metro/2014/Q5/18/people-displaced-and- 
firefighter-iniured-battling-peabodv-blaze/QWRPbS4tFSMw7ZSWPP99LL/story.html 

31. May 19, Associated Press - (New Mexico) Fire displaces apartment complex 
residents. Forty residents were displaced from an Albuquerque apartment complex 
May 18 due to smoke damage and a loss of gas and electric services caused by a fire 
that broke out in a vacant unit of the building. 

Source: http://www.newswest9.com/storv/25552143/fire-displaces-apartment-complex- 
residents 

32. May 18, KFSN 30 Fresno - (California) Fire destroys 18 apartment units in 
Lemoore. One building of the Tangle wood Apartments complex in Lemoore was 
destroyed by fire May 18, leaving about 40 residents from 18 units displaced. The 
cause of the fire is under investigation. 

Source: http://abc30.com/news/fire-destrovs-18-apartment-units-in-lemoore/66246/ 

33. May 17, WRAL 5 Raleigh - (North Carolina) Fire damages several units at Durham 
apartment complex. A fire broke out at the Spring Ridge apartment complex in 
Durham May 16, displacing 28 residents and damaging at least 6 units. Authorities 
believe the fire began in a shed that was attached to the structure. 

Source: http://www.wral.com/fire-damages-several-apartments-in-durham/13651509/ 

34. May 17, First Coast News - (Florida) 2 hurt, 47 displaced after massive Arlington 
fire. The River City Landing apartment complex in Arlington, Florida, was deemed a 
total loss after a 3-alarm fire caused extensive damage to the building’s 32 units, 
leaving 47 residents displaced. Two residents were transported to a local hospital with 
injuries. 

Source: http://www.firstcoastnews.com/storv/news/local/2014/Q5/17/two-hurt-in-3- 
alarm- fire/92095 87/ 



For another story, see item 20 
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Dams Sector 

35. May 17, St. Louis Post-Dispatch - (Missouri) Jeffco dam stabilized; residents 

allowed to return home. Officials in Jefferson County, Missouri, worked to stabili z e 
an earthen dam after a resident reported that the dam was at risk of failing and flooding 
nearby areas May 16. Around 40 homes were evacuated and residents were allowed to 
return home May 17 after the dam was secured. 

Source: http://www.stltoday.com/news/local/metro/ieffco-dam-stabilized-residents- 
allowed-to-retum-home/article bc76ac5e-41d5-5920-8ea2-e372f44f93aa.html 
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About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 
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Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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